As part of the introduction of TLV signature in public key keyrings, there is a new interpreter for CONFIG_CRYPTO_PUBLIC_KEYS in scripts/keytoc.c. All users should update to the new syntax and are presented with a warning. Users with invalid characters in the legacy syntax must change the fit-hint and will be presented with an error.
Signed-off-by: Jonas Rebmann <[email protected]> --- Documentation/migration-guides/migration-2025.12.0.rst | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/Documentation/migration-guides/migration-2025.12.0.rst b/Documentation/migration-guides/migration-2025.12.0.rst index 9d368bd970..21c8d1e3f3 100644 --- a/Documentation/migration-guides/migration-2025.12.0.rst +++ b/Documentation/migration-guides/migration-2025.12.0.rst @@ -1,6 +1,21 @@ Release v2025.12.0 ================== +Configuration options +--------------------- + +* The syntax of ``CONFIG_CRYPTO_PUBLIC_KEYS`` was updated with the introduction + of the keyring feature. Previously, keys selected via + ``CONFIG_CRYPTO_PUBLIC_KEYS`` were only used for fitimage verification. Now, + fitimage verification uses the "fit" keyring. "fit" will be selected as the + default keyring for transition but a warning will be emitted when no keyring + is explicitly provided. Existing users should update their keyspec for + fitimage public keys to ``keyring=fit[,fit-hint=<fit_hint>]:<crt>`` +* The fit-hints in ``CONFIG_CRYPTO_PUBLIC_KEYS`` are now limited to identifiers + matching the regular expression ``[a-zA-Z][a-zA-Z0-9_-]*``. Public keys with + a ``fit-hint`` not conforming to this results in an error, affected key-hints + must be changed. Please reach out to the mailing list if this causes issues. + Shell ----- -- 2.51.2.535.g419c72cb8a
